ubume 0.1.0

package/src/core/auth/codexAuth.ts

@@ -0,0 +1,359 @@
+import { spawn } from "child_process";
+import { formatCodexLaunchError, resolveCodexExecutable, spawnCodexProcess } from "../executables/codexExecutable.js";
+
+export type CodexAuthState = "checking" | "authenticated" | "unauthenticated" | "unknown";
+
+export interface CodexAuthProbeResult {
+  state: CodexAuthState;
+  checkedAt: number;
+  rawSummary: string;
+  recommendedAction: string;
+}
+
+interface CommandResult {
+  exitCode: number | null;
+  stdout: string;
+  stderr: string;
+  timedOut: boolean;
+  error?: NodeJS.ErrnoException;
+}
+
+const JSON_STATUS_FLAGS = ["authenticated", "is_authenticated", "logged_in", "signed_in"] as const;
+
+const UNAUTHENTICATED_PATTERNS = [
+  "not logged in",
+  "not signed in",
+  "no active session",
+  "login required",
+  "sign in required",
+  "unauthenticated",
+  "authentication required",
+  "run `codex login`",
+  "run codex login",
+  "please login",
+  "please log in",
+  "session expired",
+  "token expired",
+] as const;
+
+const AUTH_FAILURE_PATTERNS = [
+  ...UNAUTHENTICATED_PATTERNS,
+  "unauthorized",
+  "forbidden",
+  "invalid token",
+  "invalid grant",
+  "access denied",
+  "401",
+  "403",
+] as const;
+
+export function getAuthStateLabel(state: CodexAuthState): string {
+  switch (state) {
+    case "authenticated":
+      return "Authenticated";
+    case "unauthenticated":
+      return "Signed out";
+    case "checking":
+      return "Checking";
+    default:
+      return "Unknown";
+  }
+}
+
+export function getLoginGuidance(): string {
+  return [
+    "Sign in to the Ubume neural network to continue.",
+    "Run this in your terminal:",
+    "  codex login",
+    "",
+    "If you were previously using API-key auth and want ChatGPT subscription auth:",
+    "  codex logout",
+    "  codex",
+  ].join("\n");
+}
+
+export function getLogoutGuidance(): string {
+  return [
+    "You are managing your Ubume sign-out state.",
+    "Run this in your terminal:",
+    "  codex logout",
+    "",
+    "After logging out, use /auth status in this UI to refresh state.",
+  ].join("\n");
+}
+
+export function getAuthStatusMessage(result: CodexAuthProbeResult): string {
+  if (result.state === "authenticated") {
+    return [
+      "Ubume authentication looks healthy.",
+      "State: Authenticated",
+      `Summary: ${result.rawSummary}`,
+    ].join("\n");
+  }
+
+  if (result.state === "unauthenticated") {
+    return [
+      "Ubume is currently signed out.",
+      "State: Signed out",
+      `Summary: ${result.rawSummary}`,
+      "Recovery:",
+      "  codex login",
+    ].join("\n");
+  }
+
+  if (result.state === "checking") {
+    return "Authentication check is currently running.";
+  }
+
+  return [
+    "Ubume auth state is unknown. This can happen on unsupported neural versions.",
+    `Summary: ${result.rawSummary}`,
+    `Recommended action: ${result.recommendedAction}`,
+  ].join("\n");
+}
+
+export interface RunGateDecision {
+  allowRun: boolean;
+  blockMessage?: string;
+  warningMessage?: string;
+}
+
+export interface RunGateDecisionOptions {
+  warnOnUnknown?: boolean;
+}
+
+export function getRunGateDecision(
+  authState: CodexAuthState,
+  options: RunGateDecisionOptions = {},
+): RunGateDecision {
+  if (authState === "unauthenticated") {
+    return {
+      allowRun: false,
+      blockMessage: [
+        "Run blocked: Ubume is signed out.",
+        "Sign in first with your ChatGPT subscription:",
+        "  codex login",
+      ].join("\n"),
+    };
+  }
+
+  if (authState === "unknown" || authState === "checking") {
+    if (options.warnOnUnknown === false) {
+      return { allowRun: true };
+    }
+
+    return {
+      allowRun: true,
+      warningMessage:
+        "Auth state is unknown. Run is allowed, but if this fails, use `codex login` and try again.",
+    };
+  }
+
+  return { allowRun: true };
+}
+
+export function inferAuthStateFromProbe(
+  exitCode: number | null,
+  stdout: string,
+  stderr: string,
+): CodexAuthState {
+  if (exitCode === 0) return "authenticated";
+
+  const jsonState = inferAuthStateFromJson(stdout);
+  if (jsonState) return jsonState;
+
+  const output = `${stdout}\n${stderr}`.toLowerCase();
+
+  if (UNAUTHENTICATED_PATTERNS.some((pattern) => output.includes(pattern))) {
+    return "unauthenticated";
+  }
+
+  return "unknown";
+}
+
+export function isLikelyAuthFailure(message: string): boolean {
+  const lower = message.toLowerCase();
+  return AUTH_FAILURE_PATTERNS.some((pattern) => lower.includes(pattern));
+}
+
+export async function probeCodexAuthStatus(): Promise<CodexAuthProbeResult> {
+  const attempts: string[][] = [
+    ["login", "status", "--json"],
+    ["login", "status"],
+  ];
+
+  const summaries: string[] = [];
+
+  for (let index = 0; index < attempts.length; index += 1) {
+    const args = attempts[index]!;
+    const result = await runCodexCommand(args);
+    const summary = summarizeAttempt(args, result);
+    summaries.push(summary);
+
+    if (result.error) {
+      if (isCodexUnavailableError(result.error)) {
+        return {
+          state: "unknown",
+          checkedAt: Date.now(),
+          rawSummary: summary,
+          recommendedAction:
+            "Set CODEX_EXECUTABLE to a working Codex command/path, restart Ubume, then run /auth status again.",
+        };
+      }
+
+      continue;
+    }
+
+    const inferred = inferAuthStateFromProbe(result.exitCode, result.stdout, result.stderr);
+
+    if (inferred === "authenticated" || inferred === "unauthenticated") {
+      return {
+        state: inferred,
+        checkedAt: Date.now(),
+        rawSummary: summary,
+        recommendedAction: inferred === "authenticated" ? "None" : "Run `codex login` and retry.",
+      };
+    }
+  }
+
+  return {
+    state: "unknown",
+    checkedAt: Date.now(),
+    rawSummary: summaries.join(" | "),
+    recommendedAction: "If runs fail, sign in with `codex login`, then retry `/auth status`.",
+  };
+}
+
+function inferAuthStateFromJson(raw: string): CodexAuthState | null {
+  const trimmed = raw.trim();
+  if (!trimmed.startsWith("{") || !trimmed.endsWith("}")) return null;
+
+  try {
+    const payload = JSON.parse(trimmed) as Record<string, unknown>;
+
+    for (const key of JSON_STATUS_FLAGS) {
+      const value = payload[key];
+      if (typeof value === "boolean") {
+        return value ? "authenticated" : "unauthenticated";
+      }
+    }
+
+    const status = payload.status;
+    if (typeof status === "string") {
+      const lower = status.toLowerCase();
+      if (lower.includes("auth")) return "authenticated";
+      if (lower.includes("unauth")) return "unauthenticated";
+      if (lower.includes("signed_out")) return "unauthenticated";
+    }
+  } catch {
+    return null;
+  }
+
+  return null;
+}
+
+function runCodexCommand(args: string[], timeoutMs = 6000): Promise<CommandResult> {
+  return new Promise<CommandResult>((resolve) => {
+    let done = false;
+    let proc: ReturnType<typeof spawn> | null = null;
+
+    let stdout = "";
+    let stderr = "";
+
+    const finish = (result: CommandResult) => {
+      if (done) return;
+      done = true;
+      resolve(result);
+    };
+
+    const startWithExecutable = async () => {
+      let executable: string;
+      try {
+        executable = await resolveCodexExecutable();
+      } catch (error) {
+        const errno = error as NodeJS.ErrnoException;
+        finish({
+          exitCode: null,
+          stdout,
+          stderr: formatCodexLaunchError(errno),
+          timedOut: false,
+          error: errno,
+        });
+        return;
+      }
+
+      if (done) return;
+      try {
+        proc = spawnCodexProcess(executable, args, { stdio: ["ignore", "pipe", "pipe"] });
+      } catch (error) {
+        const errno = error as NodeJS.ErrnoException;
+        clearTimeout(timer);
+        finish({
+          exitCode: null,
+          stdout,
+          stderr: formatCodexLaunchError(errno),
+          timedOut: false,
+          error: errno,
+        });
+        return;
+      }
+
+      proc.stdout?.on("data", (chunk: Buffer) => {
+        stdout += chunk.toString();
+      });
+
+      proc.stderr?.on("data", (chunk: Buffer) => {
+        stderr += chunk.toString();
+      });
+
+      proc.on("error", (error) => {
+        clearTimeout(timer);
+        const errno = error as NodeJS.ErrnoException;
+        finish({
+          exitCode: null,
+          stdout,
+          stderr: formatCodexLaunchError(errno),
+          timedOut: false,
+          error: errno,
+        });
+      });
+
+      proc.on("close", (exitCode) => {
+        clearTimeout(timer);
+        finish({
+          exitCode,
+          stdout,
+          stderr,
+          timedOut: false,
+        });
+      });
+    };
+
+    const timer = setTimeout(() => {
+      proc?.kill();
+      finish({
+        exitCode: null,
+        stdout,
+        stderr,
+        timedOut: true,
+      });
+    }, timeoutMs);
+
+    void startWithExecutable();
+  });
+}
+
+function summarizeAttempt(args: string[], result: CommandResult): string {
+  const status =
+    result.error?.code ??
+    (result.timedOut ? "timeout" : `exit:${result.exitCode ?? "null"}`);
+
+  const combined = [result.stdout.trim(), result.stderr.trim()].filter(Boolean).join(" | ");
+  const output = combined.length > 140 ? `${combined.slice(0, 137)}...` : combined || "no output";
+
+  return `[${args.join(" ")}] ${status} - ${output}`;
+}
+
+function isCodexUnavailableError(error: NodeJS.ErrnoException): boolean {
+  return error.code === "ENOENT" || error.code === "EACCES" || error.code === "EPERM";
+}

package/src/core/codex/codexExecArgs.ts

@@ -0,0 +1,166 @@
+import type { ResolvedRuntimeConfig } from "../../config/runtimeConfig.js";
+import type { CodexCliCapabilities } from "../models/codexCapabilities.js";
+import type { ProviderImageAttachment } from "../providerRuntime/types.js";
+
+export interface BuildCodexExecArgsOptions {
+  runtime: ResolvedRuntimeConfig;
+  cwd: string;
+  structuredOutput?: boolean;
+  imageAttachments?: readonly ProviderImageAttachment[];
+}
+
+export type CodexLaunchStrategy =
+  | "direct-flags"
+  | "config-overrides"
+  | "full-auto"
+  | "fail";
+
+export type BuildCodexExecArgsResult =
+  | { ok: true; args: string[]; strategy: Exclude<CodexLaunchStrategy, "fail"> }
+  | { ok: false; error: string; strategy: "fail" };
+
+// Prevents newline/null injection into CLI args — rejects the path if it contains unsafe characters.
+function sanitizeWorkingDirectory(cwd: string): string {
+  if (cwd.includes("\n") || cwd.includes("\r") || cwd.includes("\0")) {
+    return process.cwd();
+  }
+
+  return cwd;
+}
+
+function isFullAutoRuntime(runtime: ResolvedRuntimeConfig): boolean {
+  return runtime.policy.approvalPolicy === "never" && runtime.policy.sandboxMode === "danger-full-access";
+}
+
+function buildCapabilitySummary(capabilities: CodexCliCapabilities): string {
+  const supported: string[] = [];
+
+  if (capabilities.askForApproval) supported.push("--ask-for-approval");
+  if (capabilities.sandbox) supported.push("--sandbox");
+  if (capabilities.config) supported.push("--config/-c");
+  if (capabilities.fullAuto) supported.push("--full-auto");
+
+  return supported.length > 0 ? supported.join(", ") : "none";
+}
+
+function buildRuntimeFailureMessage(runtime: ResolvedRuntimeConfig, capabilities: CodexCliCapabilities): string {
+  return [
+    "Installed Codex CLI cannot safely apply the requested runtime configuration.",
+    `Requested approval policy: ${runtime.policy.approvalPolicy}.`,
+    `Requested sandbox mode: ${runtime.policy.sandboxMode}.`,
+    `Detected launch controls: ${buildCapabilitySummary(capabilities)}.`,
+    "Update Codex or choose a runtime configuration that your installed CLI can represent.",
+  ].join("\n");
+}
+
+function buildRuntimePolicyArgs(runtime: ResolvedRuntimeConfig, capabilities: CodexCliCapabilities): BuildCodexExecArgsResult {
+  const args: string[] = [];
+  const missingDirectApproval = !capabilities.askForApproval;
+  const missingDirectSandbox = !capabilities.sandbox;
+  const runtimePolicy = runtime.policy;
+
+  if (!missingDirectApproval && !missingDirectSandbox) {
+    args.push("--ask-for-approval", runtimePolicy.approvalPolicy);
+    args.push("--sandbox", runtimePolicy.sandboxMode);
+    return { ok: true, args, strategy: "direct-flags" };
+  }
+
+  if (isFullAutoRuntime(runtime) && capabilities.fullAuto) {
+    args.push("--full-auto");
+    return { ok: true, args, strategy: "full-auto" };
+  }
+
+  if (capabilities.config) {
+    if (capabilities.askForApproval) {
+      args.push("--ask-for-approval", runtimePolicy.approvalPolicy);
+    } else {
+      args.push("-c", `approval_policy=${runtimePolicy.approvalPolicy}`);
+    }
+
+    if (capabilities.sandbox) {
+      args.push("--sandbox", runtimePolicy.sandboxMode);
+    } else {
+      args.push("-c", `sandbox_mode=${runtimePolicy.sandboxMode}`);
+    }
+
+    return { ok: true, args, strategy: "config-overrides" };
+  }
+
+  return {
+    ok: false,
+    strategy: "fail",
+    error: buildRuntimeFailureMessage(runtime, capabilities),
+  };
+}
+
+export function buildCodexExecArgs(
+  options: BuildCodexExecArgsOptions,
+  capabilities: CodexCliCapabilities,
+): BuildCodexExecArgsResult {
+  const { runtime } = options;
+  const args: string[] = ["exec"];
+
+  if ((options.imageAttachments?.length ?? 0) > 0 && capabilities.image === false) {
+    return {
+      ok: false,
+      strategy: "fail",
+      error: "Installed Codex CLI does not support image attachments. Update Codex or remove the image from the prompt.",
+    };
+  }
+
+  if (options.structuredOutput ?? true) {
+    args.push("--experimental-json");
+  }
+
+  args.push(
+    "--skip-git-repo-check",
+    "--cd",
+    sanitizeWorkingDirectory(options.cwd),
+    "--model",
+    runtime.model,
+  );
+
+  if (!capabilities.config) {
+    return {
+      ok: false,
+      strategy: "fail",
+      error: [
+        `Installed Codex CLI cannot safely apply the selected reasoning level "${runtime.reasoningLevel}".`,
+        `Detected launch controls: ${buildCapabilitySummary(capabilities)}.`,
+        "This Codex version does not support --config / -c overrides.",
+      ].join("\n"),
+    };
+  }
+
+  args.push("--config", `model_reasoning_effort=${runtime.reasoningLevel}`);
+
+  const policyArgs = buildRuntimePolicyArgs(runtime, capabilities);
+  if (!policyArgs.ok) {
+    return policyArgs;
+  }
+
+  args.push(...policyArgs.args);
+
+  for (const attachment of options.imageAttachments ?? []) {
+    args.push("--image", attachment.path);
+  }
+
+  if (runtime.policy.networkAccess) {
+    args.push("--config", `sandbox_workspace_write.network_access=${JSON.stringify(runtime.policy.networkAccess)}`);
+  }
+
+  if (runtime.policy.writableRoots.length > 0) {
+    args.push("--config", `sandbox_workspace_write.writable_roots=${JSON.stringify(runtime.policy.writableRoots)}`);
+  }
+
+  if (runtime.policy.serviceTier !== "flex") {
+    args.push("--config", `service_tier=${runtime.policy.serviceTier}`);
+  }
+
+  if (runtime.policy.personality !== "none") {
+    args.push("--config", `personality=${runtime.policy.personality}`);
+  }
+
+  args.push("-");
+  return { ok: true, args, strategy: policyArgs.strategy };
+}

package/src/core/codex/codexLaunch.ts

@@ -0,0 +1,163 @@
+import { fileURLToPath } from "url";
+import { buildCodexExecArgs, type BuildCodexExecArgsOptions, type BuildCodexExecArgsResult } from "./codexExecArgs.js";
+import { getCodexCliCapabilities, type CodexCliCapabilities } from "../models/codexCapabilities.js";
+import { resolveCodexExecutable } from "../executables/codexExecutable.js";
+import * as perf from "../perf/profiler.js";
+
+// Assumed capability set when probeCapabilities is false — avoids a slow help-output probe on every run.
+const MODERN_CODEX_CLI_CAPABILITIES: CodexCliCapabilities = {
+  askForApproval: false,
+  sandbox: false,
+  config: true,
+  fullAuto: false,
+  image: true,
+};
+
+export interface PreparedCodexExecLaunch {
+  executable: string;
+  capabilities: CodexCliCapabilities;
+  args: string[];
+  strategy: BuildCodexExecArgsResult["strategy"];
+  responsibleModulePath: string;
+  responsibleModuleKind: "src" | "built-artifact" | "other";
+  launchContext: {
+    launchKind?: string;
+    packageRoot?: string;
+    launcherScript?: string;
+  };
+}
+
+interface PrepareCodexExecLaunchDependencies {
+  resolveExecutable?: typeof resolveCodexExecutable;
+  getCapabilities?: typeof getCodexCliCapabilities;
+  diagnosticsLogger?: (message: string) => void;
+}
+
+export interface PrepareCodexExecLaunchOptions extends BuildCodexExecArgsOptions {
+  probeCapabilities?: boolean;
+  codexCommandPath?: string | null;
+}
+
+function resolveResponsibleModulePath(moduleUrl: string): string {
+  if (moduleUrl.startsWith("file:")) {
+    const windowsMatch = moduleUrl.match(/^file:\/\/\/([A-Za-z]:\/.*)/);
+    if (windowsMatch) {
+      return windowsMatch[1].replace(/\//g, "\\");
+    }
+    return fileURLToPath(moduleUrl);
+  }
+
+  return moduleUrl;
+}
+
+function classifyResponsibleModule(modulePath: string): "src" | "built-artifact" | "other" {
+  if (/[\\/]src[\\/]/i.test(modulePath)) {
+    return "src";
+  }
+
+  if (/[\\/](dist|build|out|lib)[\\/]/i.test(modulePath)) {
+    return "built-artifact";
+  }
+
+  return "other";
+}
+
+function shouldLogCodexLaunchDiagnostics(): boolean {
+  return process.env.UBUME_DEBUG_CODEX_LAUNCH === "1";
+}
+
+function logCodexLaunchDiagnostics(
+  options: BuildCodexExecArgsOptions,
+  prepared: PreparedCodexExecLaunch,
+  logger: ((message: string) => void) | undefined,
+): void {
+  if (!logger || !shouldLogCodexLaunchDiagnostics()) {
+    return;
+  }
+
+  const { capabilities, launchContext } = prepared;
+  const debugLines = [
+    "[ubume] codex launch debug",
+    `  responsible module: ${prepared.responsibleModulePath} (${prepared.responsibleModuleKind})`,
+    `  launch kind: ${launchContext.launchKind ?? "unknown"}`,
+    `  package root: ${launchContext.packageRoot ?? "unknown"}`,
+    `  launcher script: ${launchContext.launcherScript ?? "unknown"}`,
+    `  resolved executable: ${prepared.executable}`,
+    "  capabilities:",
+    `    askForApproval=${capabilities.askForApproval}`,
+    `    sandbox=${capabilities.sandbox}`,
+    `    config=${capabilities.config}`,
+    `    fullAuto=${capabilities.fullAuto}`,
+    `  chosen strategy: ${prepared.strategy}`,
+    `  structured output: ${options.structuredOutput ?? true}`,
+    `  runtime model: ${options.runtime.model}`,
+    `  runtime mode: ${options.runtime.mode}`,
+    `  final argv: ${JSON.stringify(prepared.args)}`,
+  ];
+
+  logger(debugLines.join("\n"));
+}
+
+export async function prepareCodexExecLaunch(
+  options: PrepareCodexExecLaunchOptions,
+  responsibleModuleUrl: string,
+  dependencies: PrepareCodexExecLaunchDependencies = {},
+): Promise<BuildCodexExecArgsResult & {
+  executable?: string;
+  capabilities?: CodexCliCapabilities;
+  responsibleModulePath?: string;
+  responsibleModuleKind?: PreparedCodexExecLaunch["responsibleModuleKind"];
+  launchContext?: PreparedCodexExecLaunch["launchContext"];
+}> {
+  const executableResolver = dependencies.resolveExecutable ?? resolveCodexExecutable;
+  const capabilityResolver = dependencies.getCapabilities ?? getCodexCliCapabilities;
+  const diagnosticsLogger = dependencies.diagnosticsLogger;
+  perf.mark("exec_resolve_start");
+  const executable = await executableResolver({ configuredPath: options.codexCommandPath });
+  perf.mark("exec_resolve_end");
+  perf.mark("caps_probe_start");
+  const capabilities = options.probeCapabilities
+    ? await capabilityResolver(executable)
+    : MODERN_CODEX_CLI_CAPABILITIES;
+  perf.mark("caps_probe_end");
+  const argsResult = buildCodexExecArgs(options, capabilities);
+  const responsibleModulePath = resolveResponsibleModulePath(responsibleModuleUrl);
+  const responsibleModuleKind = classifyResponsibleModule(responsibleModulePath);
+  const launchContext = {
+    launchKind: process.env.UBUME_LAUNCH_KIND,
+    packageRoot: process.env.UBUME_PACKAGE_ROOT,
+    launcherScript: process.env.UBUME_LAUNCHER_SCRIPT,
+  };
+
+  if (!argsResult.ok) {
+    return {
+      ...argsResult,
+      executable,
+      capabilities,
+      responsibleModulePath,
+      responsibleModuleKind,
+      launchContext,
+    };
+  }
+
+  const prepared: PreparedCodexExecLaunch = {
+    executable,
+    capabilities,
+    args: argsResult.args,
+    strategy: argsResult.strategy,
+    responsibleModulePath,
+    responsibleModuleKind,
+    launchContext,
+  };
+
+  logCodexLaunchDiagnostics(options, prepared, diagnosticsLogger);
+
+  return {
+    ...argsResult,
+    executable: prepared.executable,
+    capabilities: prepared.capabilities,
+    responsibleModulePath: prepared.responsibleModulePath,
+    responsibleModuleKind: prepared.responsibleModuleKind,
+    launchContext: prepared.launchContext,
+  };
+}